chromium/third_party/blink/renderer/core/testing/data/frameserialization/iframe_in_head.html

<html>
<head>
<script>
function Run() {
  // iframe in head.
  document.head.appendChild(document.createElement('iframe'));

  // iframe in a child of head.
  var d = document.createElement('div');
  document.head.appendChild(d);
  d.appendChild(document.createElement('iframe'));

  // iframe in body.
  document.body.appendChild(document.createElement('iframe'));
}
</script>
</head>
<body onload="Run()">
</body>
</html>